DEV Community

jeffrey
jeffrey

Posted on

CVE-2026-87902 Under Active Exploitation: 64 Honeypot Attempts and a GitHub-Hosted Webshell

#security #wordpress #vulnerability #rce

CVE-2026-87902 Under Active Exploitation: 64 Honeypot Attempts and a GitHub-Hosted Webshell

Vulnerability overview

CVE-2026-87902 moved from disclosure to active attack traffic within roughly a day of its patch. The WordPress core flaw, fixed in 7.1.2 and rated 8.1 on CVSS v3.1, allows unauthenticated inclusion of a readable local PHP file and can escalate to remote code execution. Telemetry reported by Patchstack and BleepingComputer shows the transition happening quickly.

Mechanism and exploitation conditions

The mechanism is a double-encoded traversal in the pagename parameter that survives early sanitisation and is decoded by get_page_template(). The template loader accepts a candidate outside the active theme directories as long as it exists, is readable, and ends in .php or .html. Full code execution additionally requires an active theme with a top-level page- directory and, in the commonly described route, PHP with register_argc_argv enabled so that pearcmd.php can be abused.

Impact

Reported intrusion activity used the flaw to try to plant a remote web shell hosted on GitHub. Honeypot sensors in the Previdian network logged 64 attack attempts from a single host in New Jersey. That pattern is consistent with opportunistic scanning followed by payload delivery against the first responsive target. A successful install would give the operator interactive command execution as the web server user, with access to configuration files and any data the process can reach.

Affected products and scope

WordPress releases below 7.1.2 are affected, and the vendor backported the fix across maintained branches. Sites most at risk combine an unpatched version with an affected theme and a permissive PHP configuration. The reported campaign did not target a specific vertical; it probed broadly, which means small and mid-sized deployments are as likely to be touched as large ones.

Exposure context

At the time of writing, ZoomEye returns 7,991,549 assets for app="WordPress" and 0 for vul.cve="CVE-2026-87902". The mismatch between a product fingerprint this large and a CVE fingerprint at zero reflects index lag rather than low exposure, and it underlines that attack traffic is already circulating before per-CVE indexing catches up.

Remediation and mitigations

Update to 7.1.2 or the backported release for the installed branch without delay. Then check for indicators of the described campaign: requests carrying traversal sequences in template parameters, outbound fetches to code-hosting domains from the web server, and newly written PHP files. Rotate credentials reachable by the PHP user if any of those indicators are present.

References

Top comments (0)